mac-flap; limit or tuning?

[brian.kennedy]

Any know how many times w/in a time frame a mac address needs to show up on two ports before a mac-flap error is logged?  And is there a way to tune that threshold?

We're running some ap's in flex mode, and a few handheld clients are roaming between access point a little too often and we're seeing mac-flap errors from these devices.  I know that's going to be somewhat normal as devices roam from one ap to another, but we obviously don't see this on every other device as it roams, so there must be a number of instances that need to happen before the alert is triggered.

We're also looking at the client to see why they're trying to roam so much.

thanks

brian

[Dmytro Skotnikov]

Hello Brian,

I believe if the address flaps 4 times between the two ports in a 15 sec period MACFLAP_NOTIF messages will be sent for that period (15 sec.)

I don't think it's possible to tune this behavior, since this is a fundamental behavior for this situation.

-- 
Best regards,
Dmitry Skotnikov

[An123]

Hi @Dmytro Skotnikov, is there any official reference or documentation confirming that if a MAC address flaps 4 times between two ports within a 15-second period, a %SW_MATM-4-MACFLAP_NOTIF message will be generated for that period?"

[Enes Simnica]

hello @An123.  Even though this was a question from 2013, it's still a relevant issue today. Cisco doesn’t publicly document the exact threshold, but from TAC cases and field experience, it usually takes 2–5 rapid MAC moves (within a few seconds) for a flap to be logged. This behavior is platform/dependent and not tunable via CLI on most IOS switches.

Cisco’s official documentation confirms that MAC flaps occur when the same MAC is seen on two different ports in quick succession  which is often normal in FlexConnect environments as clients roam.

Yet u can’t configure a flap detection threshold, but enabling PortFast on AP switchports can reduce unnecessary flaps. It’s also a good idea to check why specific clients are roaming more aggressively than others.

Let me know your switch model if you'd like a more specific recommendation. and check those 2 links G:

- https://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol-stp-8021d/221722-troubleshoot-mac-flaps-loop-on-cisco-cat.html

- https://www.cisco.com/c/en/us/tech/index.html (this one takes u to the Cisco “Technology Support” main portal, which is essentially the central hub for all Cisco technical documentation, broken down by technology....)

-Enes

[An123]

@Enes Simnica Thanks for your reply. In what cases does MAC flapping occur? If it's because of a loop, what are the scenarios that can cause the loop?

[Enes Simnica]

sure @An123 G. MAC flapping often points to a Layer 2 loop, but not always. The most common scenarios where loops (and thus MAC flaps) can occur:

• Redundant links without STP (Spanning Tree Protocol) properly configured or disabled.
• Misconfigured EtherChannel  links configured differently on each end.
• Broadcast storms caused by faulty devices or loops.
• Improper cabling, /like connecting two access ports together.

Flapping can also happen in wireless roaming (like with FlexConnect) or load balancing setups where MACs legitimately move between ports.

also check this link for some STP info G : https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-4SY/config_guide/sup6T/15_3_sy_swcg_6T/spanning_tree.pdf    it helps...

-Enes

[An123]

@Enes Simnica Thank you, sir. 

[Enes Simnica]

@An123 ur welcome G, and great question!

MAC flapping and host flapping are related, but they're not exactly the same thing.

• Mac flapping; happens when a switch sees the same MAC address bouncing between two different interfaces quickly. This usually means the switch keeps updating its MAC address table rapidly, which can be caused by: Layer 2 loops, roaming wireless clients, load balancing mechanisms, bad cabling or etherchannel mismatches....
• Host flapping, on the other hand, is a broader term, it can mean either MAC flapping at Layer 2 or IP route flapping at Layer 3 (like in dynamic routing protocols or firewalls/IPS doing ARP learning). It's context-dependent. In a pure switching context, they often mean the same thing.

also, if u want, let me know the platform u're running (Catalyst 9K, 2960, etc.), and I’ll help u narrow down causes or share commands to trace flaps in the logs.....

-Enes

[An123]

@Enes Simnica Is this limitation of setting priority in multiples of 4096 specific to Cisco switches (due to their PVST+ implementation), or is it a standard requirement followed by other switch vendors and IEEE standards as well? I want to understand if non-Cisco switches also require the same multiples or if they allow any priority value between 0 and 65535. Why this rule?

[Enes Simnica]

Yes @An123. The priority must be set in multiples of 4096 because of how the IEEE 802.1D standard defines the Bridge ID structure. It's not just a Cisco thing, cause most vendors follow the same rule.

The Bridge ID is made up of: 

• 4 bits: Bridge Priority
• 12 bits: Extended System ID (typically the VLAN ID)

Since only the upper 4 bits of the 16-bit priority field are used, it results in values like 0, 4096, 8192, etc., up to 61440. That’s why u can't set random values, it's by design, not a vendor limitation.

hope it helps G...

-Enes

[An123]

@Enes Simnica 

Thank you, sir. I have the following doubts:

1. If MAC flapping happens due to an L2 loop, what are the possible causes of the Layer 2 loop?

2. Is there any proof or documentation that shows the bridge priority being a multiple of 4096 is followed by all switch vendors?

3. Why must the bridge priority be a multiple of 4096?

4. Are the bridge priority (4 bits) and VLAN ID (12 bits) stored separately in the 16-bit field, or are they added together and stored as a single value?

[Enes Simnica]

@An123 great set of questions G. lets go..: so will answer each question one by one...

1. If MAC flapping happens due to an L2 loop, what are the possible causes of the Layer 2 loop?

Layer 2 loops G, can be caused by:

• Redundant links without STP (Spanning Tree Protocol) enabled
• STP misconfigurations — like BPDU filtering or guard wrongly applied

• EtherChannel mismatches (config not consistent on both sides)

• Accidentally connecting two access ports together (bridging VLANs unintentionally)

• Misbehaving or faulty end devices creating bridging loops

meaning that, once a loop forms, broadcast or and multicast traffic can circulate endlessly, which causes MACs to flap between interfaces and thats why switch gets very busy and confused at the same time.....

now the second question: 2. Why must the bridge priority be a multiple of 4096? This is definded by the ieee 802.1D standard, which means that its not just a Cisco rule. Because the 16bit bridge ID field in bpdu consists of 4bits (bridge priorityy) and 12 bitsss (which is the extended system..) and since only 4 bits are used for actual priority, valid values are 2⁴ = 16 increments of 4096 (0, 4096, 8192, ..., 61440).

3. Is there any proof or documentation that shows this 4096 rule is followed by all switch vendors? Yes G most vendors follow this because it's baked into the 802.1D standard. Even if they don’t use PVST+ like Cisco, their STP implementations (RSTP, MSTP, etc.) still follow the same Bridge ID structure.

4. Are the bridge priority (4 bits) and VLAN ID (12 bits) stored separately in the 16-bit field, or added together and stored as a single value? THey are stored as a single 16bit value but composed of two logical parts, the upper 4 bits and the lower with 12 bits

hope it helps, also check these links (the first one is a very very sick video from Kevin Wallace, with a deep dive of 2 hours plus, it is just SICK):

• https://www.youtube.com/watch?v=XoLPGH4awKc&t=2909s 
• https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-4SY/config_guide/sup6T/15_3_sy_swcg_6T/spanning_tree.pdf 
• https://www.cisco.com/c/en/us/support/docs/smb/switches/cisco-small-business-300-series-managed-switches/smb5760-configure-stp-settings-on-a-switch-through-the-cli.pdf 
• https://www.networkacademy.io/ccna/spanning-tree/how-stp-works 

[An123]

Thank you, @Enes Simnica

Is there any documentation that explains these causes in detail with examples?

[Enes Simnica]

sure @An123 :

• https://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/10556-16.html?utm_source
• https://www.examcollection.com/certification-training/ccnp-troubleshoot-etherchannels-spanning-tree.html?utm_source
• https://networkengineering.stackexchange.com/questions/5137/mixing-cisco-stp-features-bpdu-guard-bpdu-filter-portfast-and-portfast-trunk?utm_source
• https://networkengineering.stackexchange.com/questions/5137/mixing-cisco-stp-features-bpdu-guard-bpdu-filter-portfast-and-portfast-trunk?utm
• https://www.examcollection.com/certification-training/ccnp-troubleshoot-etherchannels-spanning-tree.html?utm_
• https://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/28943-170.html?utm_source=chatgpt.com 

also check other Cisco books like CCNA, CCNP and more... hope it helps

-Enes

[An123]

@Enes SimnicaIs it possible that SR-IOV is creating a loop? If any document related to this, kindly share.